CVE-2020-35489

—

CVSS 3.1

10.0 critical

EPSS

89%p100

Published

Dec 17, 2020 (Dec 17, 2020)

Modified

Jun 17, 2026

Description

The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters.

Vendors: rocklobster
Products: contact form 7
Ecosystems: WordPress
Weakness: CWE-434
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (89.3%)

In the news0 stories

No ingested article mentions this CVE yet.